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Abstract — We propose an information theoretic framework 
for the secure two-party function computation (SFC) problem 
and introduce the notion of SFC capacity. We study and extend 
string oblivious transfer (OT) to sample-wise OT. We propose an 
efficient, perfectly private OT protocol utilizing the binary erasure 
channel or source. We also propose the bootstrap string OT proto- 
col which provides disjoint (weakened) privacy while achieving a 
multiplicative increase in rate, thus trading off security for rate. 
Finally, leveraging our OT protocol, we construct a protocol for 
SFC and establish a general lower bound on SFC capacity of the 
binary erasure channel and source. 

I. Introduction 

Motivated by applications ranging from confidential 
database access to oblivious contract negotiation [1], we study 
the problem of secure two-party function computation (SFC). 
In this problem, Alice and Bob each have private data, and 
they wish to compute functions of both of their data. The 
objective is to design a protocol that ensures correctness of 
the computed functions while maintaining individual privacy, 
in the sense that neither party gains any information about the 
other's data other than what can be inferred from the result of 
their function computation. An important special case of this 
problem is string oblivious transfer (OT) from [2], wherein 
Alice has two strings Aq and A\ and Bob has a single bit B. 
An OT protocol should reveal Ab to Bob, while Alice remains 
ignorant of B and Bob of A(i_b)- 

In this work, we propose an information theoretic frame- 
work for SFC and introduce the notion of SFC rates and 
capacity, in terms of the ratio of samples of computation to 
samples of correlated randomness needed. Correlated random- 
ness is a noisy resource in the form of a noisy communication 
channel or distributed random source available between the 
parties. We cast the string OT problem as a special case 
within our framework and also introduce the sample-wise OT 
problem. We address the string and sample-wise OT problems 
with an efficient perfectly private protocol utilizing the binary 
erasure channel or source. For the string OT problem, we 
also propose the bootstrap protocol which provides disjoint 
(weakened) privacy while achieving a multiplicative increase 
in rate, thus trading off security for rate. Finally, leveraging 
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our OT protocol, we construct a protocol for SFC and establish 
a general lower bound on SFC capacity binary erasure channel 
and source. Due to space limitations, detailed proofs are 
omitted, but will appear in an extended version of this work. 

Our objective is information theoretic (unconditional) secu- 
rity, where even computationally unbounded adversaries must 
not be able to break the privacy. We work with the assumption 
of semi-honest (or passive) parties, where the parties honestly 
follow the protocol. It is well-known that in this setting both 
OT and SFC cannot be realized "from scratch" [3], [4], that is 
with protocols using only noise-free communication channels 
and local randomness. It has been observed that OT becomes 
possible given correlated randomness [5], [6], [7], [8], and that 
SFC also becomes possible based on OT [3]. Thus, correlated 
randomness is a valuable resource as an enabling factor for OT 
and SFC. Recently the concept of OT capacity of a channel 
or source, measuring the fundamental limit of how efficiently 
the resource can be used toward OT, has been introduced in 
[9], [7] and further characterized by [8], [10]. 

II. Problem Formulation 

In this section, we first formulate the SFC problem within 
a novel information theoretic framework. This framework uti- 
lizes conditional mutual information based privacy measures, 
and defines achievable function computation rate and capacity. 
We then discuss OT which is encompassed by this SFC 
framework as a special case. In the last subsection we present 
the problem of string OT with the notion of disjoint privacy. 

A. Secure Two-Party Function Computation 

Two parties, Alice and Bob, each have k samples of a 
jointly distributed source on the finite alphabets Ax B, where 
Alice possesses A k = {A±, . . . , Ak} E A k and Bob possesses 



{B h ...,B k } E B k , with (A k ,B k 



P 



A k ,B k 



B k 

For a given function / : A x B — > TZf, Alice wishes 
to compute samples of a function of the sources F k = 
{f(Ai, Bi), . . . , f(Ak, Bk)}. Similarly, Bob wishes to com- 
pute G k 4 {g(A 1 ,B 1 ),...,g(A k ,B k )} where g : A x B -> 
lZ g . Alice and Bob cooperatively compute these functions 
via an interactive protocol that may exchange messages over 
an error-free discussion channel and also utilize n samples 
of correlated randomness. The correlated randomness is a 
precious resource which comes in two possible forms: 



• Source-model: For i = l,.,.,n, (Xi,Yi) ~ Px,y- 
X n = (X 1 ,...,X n ) is available to Alice and Y n ' = 
(F!,...,y n ) to Bob. 

• Channel-model: X n and Y n are respectively the se- 
quence of inputs and outputs of a discrete memoryless 
channel (DMC) with conditional distribution Py\x, with 
X n selected by Alice and Y n received by Bob. 

An acceptable (n, fc)-protocol for source-model correlated 
randomness is defined as follows. First, Alice and Bob receive 
(A k , X n ) and (B k , Y n ), and generate local random variables 
Za and Zb respectively, where Za, Zb, (A k ,B k ), and 
(X n , Y n ) are mutually independent. Then, over r stages, Alice 
and Bob exchange messages Mi , . . . , M r over the error-free 
discussion channel, where in an odd numbered stage i Alice 
produces message Mj as a function of everything available to 
her, namely (A k , X n , Z A , M 4 " 1 ), and in an even numbered 
stage j Bob produces the messages Mj as a function of 
everything available to him, namely (B k , Y n , Zb, M j_1 ). At 
the end of the protocol, Alice and Bob produce function 
estimates F k and G k as functions of (A k , X n , Za, M r ) and 
(B k , Y n , Z B ,M r ) respectively. 

An acceptable (n, fc)-protocol for channel-model correlated 
randomness is similar to the source-model protocol, but 
(X n ,Y n ) are not given at the beginning of the protocol. 
Instead, the samples X n are generated by Alice, transmitted 
into the DMC, and outputs Y n are received by Bob. The DMC 
transmissions may be arbitrarily interspersed with discussion 
stages (including happening entirely before or after the discus- 
sion messages are exchanged). At each stage or transmission, 
the discussion message or channel input symbol is a function 
of everything available to the sending party. A source-model 
protocol can be realized as a special case of the channel-model 
if Alice randomizes the inputs, for i — l,...,n, Xi ~ Px, 
and transmits before any discussion messages are sent. 

For both models, R > is a called an achievable SFC rate 
for the particular sources, functions, and correlated random- 
ness if for every e > 0, and all sufficiently large n, there exists 
an acceptable (n, fc)-protocol with (k/n) > R — e satisfying 
the following 

. (Correctness) Pr[F k ^ F k ] < e and Pr[G k ^ G k ] < e, 

• ( Privacy for A lice ) 

I{A k -Z B ,Y n ,M r \B k ,G k )<e, (1) 

• (Privacy for Bob) 

I(B k ;Z A ,X n ,M r \A k ,F k ) < e. (2) 

A protocol is said to be perfectly private if the privacy con- 
straints of (fl3 and (O are exactly zero. The SFC capacity C for 
the particular sources, functions, and correlated randomness is 
defined as the largest achievable function computation rate, 
and if no rate R > is achievable. 

B. Sample-wise Oblivious Transfer 

The 1-out-of-m sample-wise OT problem is a special case 
of the SFC problem, wherein Alice's source alphabet is A = 



{0, l} m , Bob's source alphabet is B = {l,...,m}, Alice's 
function is constant / = 0, and Bob's function is given by 
g((ai, . . . , a m ), b) — at,. For clarity of exposition, let A be 
the k x to binary matrix formed by vertically stacking Alice's 
TO-bit samples A%, . . . ,Ak as the rows. Bob wishes to receive 
the k bits G\,...,Gk, where Gi = A.;.^. Alice's privacy 
condition ((TJ means that Bob obtains no information about the 
other k(m — 1) bits of A that he did not select. Bob's privacy 
condition (O means that Alice obtains no information about 
Bob's selection B k . When dealing with the above scenario, 
we speak of achievable sample-wise OT rate Ror,m, and the 
sample-wise OT capacity CoT,m- 

C. String Oblivious Transfer with Disjoint Privacy 

The 1-out-of-m string OT problem is a special case of 
the 1-out-of-m sample-wise OT problem, wherein the source 
distribution is specified as 

F A k B k{a ,0 ) - < 

I 0, otherwise, 

that is, Alice's source samples A k consist of km iid Bernoulli- 
(1/2) bits and is independent of Bob's source B k which 
always consists of identical samples uniformly distributed over 
B = {1, . . . , to}. Interpreting this scenario, Alice has to, fc-bit 
strings A\, . . . , A m , which are aligned as the columns of A, 
and Bob has the selection B = B\ and wishes to receive the 
fc-bit string Ab- 

Alice's privacy condition (Q]) reduces to 

/({^}ti^ B ;^,y n ,M r |S,i B ) < e, 

which implies that Bob is unable to reconstruct any string 
that he did not select or any non-trivial joint function of the 
strings that he did not select without non-negligible probability 
of error. The interesting alternative notion of disjoint privacy 
replaces Alice's privacy condition (Q]) with 

fori e {1,..., to}, I(A t ;Z B ,Y n ,M r \B,A B ) <e, (3) 

which implies that Bob is unable to reconstruct any non-trivial 
function of any individual string (including the string itself) 
that he did not select without non-negligible probability of 
error. A protocol that satisfies (Q~|i will also satisfy this disjoint 
privacy condition (O, however the converse is not true. For 
example, a protocol that reveals to Bob Ab and also the 
binary exclusive-or (XOR) all of the strings Ai ® . . . © A m 
will satisfy the disjoint privacy constraint, but will not satisfy 
(Q]l. A protocol obtains perfect disjoint privacy if the privacy 
constraints of (0) are exactly zero. 

The motivation for considering the weakened sense of 
disjoint privacy is to explore protocols (see Section HVb that 
tradeoff privacy in order to achieve higher rates than the 
sample- wise OT protocol of Section ITlI-AI When dealing with 
the above scenario with the disjoint privacy condition (O 
replacing Alice's standard privacy condition (Q]), we speak of 
achievable string OT rate with disjoint privacy RoT.m, and 
string OT capacity with disjoint privacy CoT.m- 



III. Sample- wise Oblivious Transfer 

In this section, we present the sample-wise oblivious trans- 
fer (SWOT) protocol. Later on, by leveraging the SWOT 
protocol, we construct protocols for string OT with disjoint 
privacy (see Section HV-Ab and for SFC (see Section IV-AI ). 
The SWOT protocol utilizes correlated randomness in form 
of the binary erasure channel (BEC) and the binary erasure 
source (BES). The BEC(p) has the input and output alpha- 
bets X = {0,1} and y = {0,1, e}, with the conditional 
distribution P Y \ x {y\x) = pl( y = e ) + i 1 ~ P)l(y=x). where 
p is the the probability of erasure. The BES(p) has the joint 
distribution Px,y{x,u) = (^/^)Py\x(u\x)- The protocol will 
be described as a source-model protocol for the BES(p), which 
is easily adapted into a channel-model protocol for the BEC(p) 
by adding the initial step of Alice transmitting n iid Bernoulli- 
(1/2) bits into the BEC in order to simulate n samples of 
a BES. Because of the interchangeability of the BEC and 
BES, we will write BES/BEC(p) to denote that the correlated 
randomness is either the BEC(p) or BES(p). 

A. Sample-wise Oblivious Transfer Protocol 

This protocol is inspired by the protocols for the binary 
erasure channel given by [8], [9]. The novel aspects of our 
protocol are the treatment of sample-wise as opposed to string 
oblivious transfer and the mechanism of failing into an error 
case when privacy cannot be provided. This yields a perfectly 
private protocol with roughly the same negligible probability 
of error, and also simplifies analysis of both privacy and 
error. The perfect privacy of this protocol is important since 
it enables it to be leveraged in a secure black-box manner to 
construct other protocols without complicating the analysis of 
privacy. The basic idea of this protocol is to use the erasures 
of the BES/BEC to conceal the k(m — 1) bits at the locations 
in A that Bob must remain ignorant of, while using the non- 
erasures to reveal the k bits at the locations in A that Bob has 
selected. 

• Bob partitions {l,...,n} into the set of locations of 
erasures S e and locations of non-erasures S in Y n , that 
is, Yi = e if and only if i E S e , and S = {1, . . . , n} \ S e . 

• If there is not enough erasures or non-erasures, k > \S\ 
or k(m — 1) > \S e \, then the protocol aborts and Bob 
sets his function estimate to G k = k . 

• Otherwise, the protocol continues and Bob creates an 
k x m matrix U, where at each of the k positions specified 
by {(i, Bi) : i = 1, . . . , k}, a random, uniform selection, 
without replacement, from S is placed. Similarly, at the 
other k(m — 1) positions, a random selection from S e 
is placed. Bob sends the matrix U to Alice via the 
discussion channel. 

• The k x m matrix U, whose elements belong to 
{1, ...,n} specifies how Alice should arrange km of 
the n bits X n into the k x m binary matrix Xu, via 
Xu(i,j) = X\juj\. Alice computes C = A0Xu, 
where (J) denotes element-wise binary exclusive-or 
(XOR), and sends C to Bob over the discussion channel. 



• Bob is able create his function estimate G k by reversing 
the XOR since Yu is equal to Xu at locations corre- 
sponding to the locations of A that he has selected. 

B. Analysis and Achievable Rates 

The SWOT protocol is perfectly private for Bob since any 
U is uniformly possible given any realization of Bob's samples 
B k because erasures uniformly and independently occur in 
Y n . The protocol is perfectly private for Alice since C is 
only sent to Bob if the protocol does not abort and there have 
been enough erased bits, acting as a Bernoulli- (1/2) one-time 
pad, to mask the k(m — 1) bits that should be concealed. The 
protocol is correct if it does not abort, thus the probability of 
error is bounded by the probability of aborting, which becomes 
negligible for n sufficiently large if k < n(l — p) = K\S\ 
and k(m — 1) < np = E|5 e |, by the law of large numbers. 
Thus, the rate RoT.m — min((l— p),p/(m — 1)) is achievable 
by this protocol. This protocol is distribution-free since the 
above arguments hold not only for any distribution, but also 
for any realization of the sources (A k ,B k ). These results are 
summarized in the following theorem 

Theorem 3.1: For any arbitrary source distribution PA k ,B k , 
the SWOT protocol, utilizing correlated randomness in the 
form a BES/BEC (p), obtains perfect privacy and achieves the 
1-out-of-m sample-wise OT rate 

RoT, m = min((l -p),p/(m - 1)). 

Hence, the l-out-of-?n sample-wise OT capacity for a 
BES/BEC (p) and for arbitrary source distributions is bounded 
below by 

Cor.ra > RoT.m = min((l -p),p/(m - 1)). 

An upper bound to the sample-wise OT capacity for general 
correlated randomness is established by the following theorem. 

Theorem 3.2: For the uniform source distribution and gen- 
eral source-model correlated randomness, we have 

Cot,u < min(/(X; Y),H(X\Y)/(m - 1)). 

For channel-model correlated randomness, the right side of the 
above expression is maximized over Px- 

The proof of this theorem is omitted due to space limi- 
tations. It follows from the methods and results used in [8, 
Theorem 1] and [9, Lemma 7]. 

For the BES(p), H(X\Y) = p and I(X;Y) = 1 - p. 
For the BEC(p), max Px mm(I(X; Y), H{X\Y)/(m - 1)) = 
min((l — p),p/(m — 1)) with the maximum achieved by 
Px = (1/2). Thus, the capacity upper bound of Theorem 13.21 
matches the capacity lower bound of Theorem 13.11 implying 
the following corollary. 

Corollary 3.1: The 1-out-of-m sample-wise OT capacity 
for the uniform source distribution and correlated randomness 
in the form of a BES/BEC (p) is given by 

CoT.m = min((l -p),p/(m - 1)). 

The SWOT protocol achieves capacity. 
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Fig. 1. The encoding tree structure for the BOOT protocol for 1-out-of-l 
string OT, with parameters u = 2, si = 2 and S2 = 3. 



Note that this capacity is maximized at C = (1/to) for 
the erasure probability p* = (to — l)/m, where the ratio of 
erasures to non-erasures matches the ratio of bits concealed to 
bits revealed. The SWOT protocol achieves capacity since it 
efficiently utilizes the erasures and non-erasures in revealing 
and concealing the appropriate bits. 

IV. String OT with Disjoint Privacy 

The bootstrap OT (BOOT) protocol addresses the prob- 
lem of string OT with the disjoint privacy condition ©. 
The SWOT protocol could also be applied to this problem, 
yielding the achievable rate given in Theorem 13.11 with the 
stronger sense of joint privacy (Q~|i. However, the BOOT 
protocol achieves rates that are better by a factor up to 
( (m — 1 )/ [log 2 m] ) (when the probability of erasure p < 1/2) 
since it provides only disjoint privacy. 

A. Bootstrap String Oblivious Transfer Protocol 

The BOOT protocol for 1-out-of-m string OT is param- 
eterized by a finite sequence of u integers, s\,...,s u 6 
{2, . . . , to}, such that n"=i s i ^ m - The BOOT protocol 
leverages u uses of the SWOT protocol, where the i-th usage 
is for 1-out-of-Si OT. For i = 1, ...,it, Alice generates Si, 
independent fc-bit Bernoulli- (1/2) masking strings {Zi ^yLi- 
The basic idea is to encode each one of Alice's strings with 
the XOR of a different combination of u of these masking 
strings, taking one from each set {/,. ,}' . for i = 1, . . . , u. 
Alice first sends these encodings, denoted by C\, . . . , C m , to 
Bob over the discussion channel. Then, for Bob to decode a 
particular string of Alice's, Alice and Bob perform u oblivious 
transfers where in the z-th OT Bob chooses from {Zij}j' =1 
the masking string that is part of the combination masking 
the string of Alice's that he wants. The method in which each 
string of Alice is assigned a unique combination of masking 
strings can be visualized by a tree structure. 

The encoding tree structure for the example of l-out-of-6 
string OT via the BOOT protocol with parameters u = 2, 
Si = 2 and s 2 = 3 is illustrated in Figure [TJ In this example, 
if Bob wishes to obtain A s , he would select Z\\ in first round 
of OT and then select Z 23 m second round of OT, allowing 
him to reconstruct A 3 via C3 © Z\ \ © Z 2 3. 

B. Analysis and Achievable Rates 

The perfect privacy of the SWOT protocol guarantees that 
Bob only learns the particular combination of masking strings 
Zi j that he selected, however, by the structure of the encoding, 



its possible for Bob to learn some information about Alice's 
strings beyond just the knowledge of Ab- However, Bob will 
not be able to determine the specific value of any particular 
string Ai for i ^ B. Consider the example of l-out-of-6 string 
OT illustrated in Figure [TJ for B = 3. Since Bob learns Z± t i 
and Z 2i 3, he can also determine certain joint functions of 
Alice's strings such as A\ © A4 © Aq, which can be found 
from Ci © Ci © C 6 © Z lf i © Z 2 . 3 . Note that however, Bob 
cannot reduce any of the equations further to determine the 
value of any Ai for i ^ 3. The proof for the general situation 
is omitted due to space limitations. 

The correctness of the protocol follows if each of the 
u usages of the SWOT protocol is correct, which happens 
if there is enough erasures and non-erasures in BES/BEC 
samples in each usage. Note that instead, all of the BES/BEC 
samples can be taken at the beginning, with the erasures 
and non-erasures being allocated to multiple usages if they 
are sufficient, which will happen with high probability for n 
sufficiently large provided that k/n is slightly less than the 
achievable rate determined by the following rate analysis. 

For each round i = 1, . . . , u, the SWOT protocol for 1- 
out-of-,Si OT of fc-bit strings requires asymptotically n, = 
k/ Rot. St samples of the BES/BEC. The total number of sam- 
ples of BES/BEC needed is n = J2i=i n i = Y^i=i k/RoT,si- 
Thus, the asymptotic rate achieved by this protocol is given 
by the following theorem. 

Theorem 4.1: Let s±, . . . , s u £ {2, . . . , to} be a finite 
sequence of integers such that Yli=i s i — m - Then, the BOOT 
protocol with parameters (si,...,s u ) for a BES/BEC(p) 
obtains perfect disjoint privacy and achieves the string OT 
rate 

(I; *b) • 

where Rot,s = min((l — p),p/(s — 1)) is the achievable 
sample-wise OT rate for the BES/BEC (p) from Theorem 13. II 
Hence, the string OT capacity (with disjoint privacy) is 
bounded below by 

CoT.m > max ( — — ) 

«,si,...,s„ \ ^ RoT,s z J 

where the maximization is taken over the set of finite 
sequences of integers s±,...,s u € {2,..., to} such that 

nr=i ^ ^ m - 

The SWOT protocol is most efficient for erasure probability 
p* = (m — 1)/to, since it needs a large proportion of erasures 
to fully conceal the k(m — 1) bits that Bob did not select. 
The best erasure probability for the BOOT protocol, however, 
is variable and depends on the choice of parameters. For 
example, setting u = [log 2 to] and s, = 2 for all i, yields 
the achievable rate 

Rot,2 mm(p, (1 -p)) 



Rot-, 



[log 2 to] 



which is maximized at RoT,m = l/(2[log 2 m~|) for p = 
(1/2). Comparing this to the achievable sample-wise OT 



Achievable Rates for Bootstrap 1-out-of-10 OT 
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Fig. 2. Achievable rates of the BOOT protocol for l-out-of-10 string OT as 
a function of erasure probability p of the BES/BEC(p). Each curve represents 
the achievable rates for a different set of parameters of the BOOT protocol. 

rate for p — (1/2), Ror.m = l/(2(m — 1)) reveals an 
improvement in rate by a factor of ((to — l)/(|~log 2 to])). 
The BOOT protocol achieves higher rates since it effectively 
recycles the erasures to conceal more bits. Some information 
is leaked since the erasures are being recycled, however, only 
joint functions of the strings (specifically the exclusive-or of 
multiple strings) are revealed while maintaining the disjoint 
privacy. Note that for the parameters u = 1 and si = to, the 
BOOT protocol achieves the same rate as the SWOT protocol. 
Thus, the BOOT protocol can achieve any rate achieved by 
the SWOT protocol. 

Figure |2] illustrates the achievable rates of the BOOT 
protocol, with m = 10, as a function of erasure probability 
p of the BES/BEC (p), for various sets of parameters. Note 
that in different ranges, different sets of parameters are best. 
The BOOT protocol for parameters {si = 10} (giving the 
performance of the SWOT protocol) is best only in the range 
of erasure probability close to p = (in — l)/m and above. 

V. Secure Function Computation 

The general secure function computation (GSFC) protocol 
leverages the SWOT protocol. It uses two oblivious transfers, 
where the first is from Alice to Bob and the second is from 
Bob to Alice, reversing the roles. Since the SWOT protocol 
uses a BES/BEC in the direction of the transfer, the GSFC 
protocol uses a BES/BEC available in both directions. The rate 
is determined as the ratio of function samples k to the total 
number of BES/BEC samples used in both directions. 

A. General SFC Protocol 

This protocol is applicable to any general sources and func- 
tions. Without loss of generality, let the finite source alphabets 
be given by A = {1, . . . , to^} and B = {1, . . . , tub}, and 
the ranges of the functions / and g be IZf = {0,1}' IA and 
Tig = {0, l}' ls respectively. 

We outline the GSFC protocol with the following steps. For 
Bob to compute G k , Alice generates tub, fc/is-bit strings, for 
i = l,...,m B , A\ = (g(A 1 ,i),...,g(A k ,i)). Bob expands 
his k source samples B k to a vector of length khs, where each 



element of B k is repeated hs times to produce the samples 
B' kllB . Alice and Bob then use the SWOT protocol to perform 
l-out-of-m B OT for kh B -bit strings with as Alice's 

strings, and Bob's selections vector as B' khB . The result of 
this OT gives Bob (g(Ax,B x ), g(A k , B k )). Similarly, for 
Alice to compute F k , Alice and Bob reverse roles and perform 
1-out-of-TO^ OT for fc/is-bit strings from Bob to Alice. 

B. Analysis and Achievable Rates 

The perfect privacy, negligible probability of error, and 
distribution-free properties of SWOT protocol imply the same 
properties in this secure function computation protocol. The 
l-out-of-TOs OT for fc/is-bit strings via the SWOT protocol 
asymptotically requires n\ = khs / RoT,m B samples of a 
BES/BEC from Alice to Bob, and likewise the other OT 
requires n 2 = kfiA/RoT,m A samples of a BES/BEC from 
Bob to Alice, yielding the following theorem. 

Theorem 5.1: Let niA = \A\, ms = \B\, h,A = 
[log 2 | Tlf I] , and Iib — |~log 2 \Tlg\~\- Then, the GSFC protocol, 
utilizing correlated randomness in the form a BES/BEC (p) 
available in both directions, is perfectly-private, distribution- 
free and achieves the function computation rate 

R= ( hB + Ha \ 

\RoT,m A RoT,m B ) 

where RoT,m = min((l — p),p/(m — 1)) is the achievable 
sample- wise OT rate from Theorem 13. II The function compu- 
tation capacity is bounded below by C > R. 

The GSFC protocol is general, but not optimal since it 
does not exploit any source correlation or functional structure. 
Note that only one usage of the SWOT is necessary if one of 
the functions /, g is a function of (or the same as) the other 
function. 
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